feat: enhance CATMAID authentication with personal API token support

[afonsobspinto]

Summary

Adds personal API-token authentication to the CATMAID datasource while preserving anonymous access for public projects.

Previously, Neuroglancer could only obtain CATMAID’s anonymous API token. Private projects—and edit operations where AnonymousUser only has read access—could not escalate to an authenticated CATMAID account.

Authentication behavior

Scenario	Behavior
No personal token configured	Use CATMAID’s anonymous API token
Anonymous request returns 403	Prompt for a personal API token and retry
Any token returns 401	Treat it as rejected, request replacement credentials, and retry
Personal token returns 403	Report insufficient permissions without repeatedly prompting

Browser-hosted viewers

• Displays a modal personal-token prompt when anonymous access is insufficient.
• Stores personal tokens in sessionStorage, scoped by canonical CATMAID server URL.
• Reuses the token across projects on the same server and across reloads in the current tab.
• Removes rejected personal tokens before requesting a replacement.
• Keeps tokens out of datasource URLs and serialized viewer state.
• Preserves existing request headers when adding the Authorization header.

Python-hosted viewers

Adds:

neuroglancer.set_catmaid_token(server_url, token)